Security Policy
Contact
We are grateful for any reports of security related issues. Our contact-address for security reports is listed in the well-known security.txt file, as dictated by standards. In case you are unable to locate the file, you may e-mail any of the other e-mail addresses you find, and ask that your mail be forwarded to the IT staff.
Language
We are best communicating in English or German, anything other than that we'll have to run through translators.
Scope
You are welcome to perform ethical (non-destructive, and to the best of your abilities, non-disruptive) work to probe for security issues, without having to worry about repercussions from us. In case your actions unexpectedly end up being disruptive after all, we kindly ask that you cease your probing and contact us, so that we can restore service, before continuing. It'd be appreciated if you emailed us at the address mentioned in the well-known security.txt file on this website; if you add "-pager" at the end of the e-mail address (before the domain part), your mail will end up paging our staff for immediate attention.
Bounty
We do not have an active bug bounty program, but will nevertheless be grateful for any reports. Making the issue known to us in a way so that it can be fixed is an integral part prior to any further discussion. Mails that do not disclose anything tangible or mails that hold information at ransom will not receive a reply.